Blazor Secure Api

Question

I am developing an Application in Microsoft Blazor. I have secured all the UI Pages using a custom AuthenticationStateProvider class which searches for a cookie on the browser.

The by restricting the @Body on the MainLayout.razor every page is secured and not readable when the user is not autorized.

   <div class="page">
       <Sidebar />

        <div class="main">
            <Header />

            <article class="content px-4">
                <AuthorizeView>
                    <NotAuthorized>
                        <div class="row">
                            <div class="col-md-4">
                                <p>Please sign in to use the Platform...</p>
                            </div>
                        </div>
                    </NotAuthorized>
                    <Authorized>
                       @Body
                    </Authorized>
                </AuthorizeView>
            </article>

        </div>
    </div>

The issue is that the ./api endpoint is still accessible for not authorized users as the controllers are still active.

    [Route("api/User")]
    [ApiController]
    public class Controller_User : ControllerBase
    {
        private readonly Interface_User _IUser;

        public Controller_User(Interface_User iUser)
        {
            _IUser = iUser;
        }

        [HttpGet, Route("/api/user/view")]
        public async Task<List<User>> GetUsers()
        {
            try { return await Task.FromResult(_IUser.GetUsers()); }
            catch { throw; }
        }
    }

Any ideas how we can secure all ./api urls at once like the razor pages?

If this is a WASM application with an API then you are dealing with two separate authentication processes. How do you pass your "cookie" data in the header to your web server and authenticate that information. You need to authenticate the API request before you can authorize it. Once you have a ClaimsPrincipal you can build a "base" controller that defines the authorization and inherit any controllers that require authorization for the base. — MrC aka Shaun Curtis
– MrC aka Shaun Curtis, Commented Dec 29, 2022 at 11:52
Yes is WASM and I am storing a username with localstorage on sign in, so if CustomAuthStateProvider reads this username from localstorage it changes the state. Do you have an example for basic controller? — Stavros Koureas
– Stavros Koureas, Commented Dec 29, 2022 at 12:58

MrC aka Shaun Curtis · Accepted Answer · 2022-12-29 13:56:30Z

2

Example using inheritance to apply Authorization to controllers.

Two abstract controllers

[Authorize]  
public abstract class AuthorizedController: Controller {}

[Authorize(Policy = "AdminOnly")]
public abstract class AdminOnlyAuthorizedController: Controller {}

And then some implementations

public sealed class WeatherForecastController: AuthorizedController {  
//....
}

public sealed class WeatherLocationController: AuthorizedController {  
//....

public class MyAdminController: AdminOnlyAuthorizedController {  
//....
}

answered Dec 29, 2022 at 13:56

MrC aka Shaun Curtis

32.4k3 gold badges27 silver badges56 bronze badges

Sign up to request clarification or add additional context in comments.

Collectives™ on Stack Overflow

Blazor Secure Api

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related